CVE-2026-83772: Command Injection in Cobham SATCOM VSAT7090 Maritime Satellite Router

This vulnerability in the Cobham SATCOM VSAT7090 Maritime Satellite Router allows remote attackers to perform command injection via manipulation of the sender or recipients arguments in the c_set_reports_decode function of the mail-report.sh script, which handles JSON parsing. The issue affects all versions up to 20260704. The vendor was contacted but did not provide any response or patch. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impacts on confidentiality, integrity, availability, and security requirements. Public exploit code is available, increasing the risk of exploitation.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected device, potentially leading to full compromise of the router. This can impact confidentiality, integrity, and availability of the device and its communications. Given the device's maritime satellite router role, exploitation could disrupt critical satellite communications.

No official fix or patch is currently available from the vendor. Since the vendor has not responded and no remediation guidance exists, users should apply network-level protections such as restricting access to the device management interfaces to trusted networks only. Monitor for suspicious activity related to the mail-report.sh script. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.